cobaltstrike | 02a81b942a6ff505d51a8739cb492fb63afc67fdc1754c8861a90ca4b38c5e3a

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
Size 5.2MB
Sample240602-p69scach6w
SHA256 02a81b942a6ff505d51a8739cb492fb63afc67fdc1754c8861a90ca4b38c5e3a
MD5 9038eba5bd7b574f7df2ee28619883b2
SHA1 1dae0703e9f9f95b73b9de0eea0d7192ca463c49
SHA512 bc47fd390d6bd411d016e502681624a542d19bc962e2d0724685274bdca423a0f5d0b1270176c1375090b6f376879dea059b1d4cdddaf63c12b76daf6bb60e27
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lQ:RWWBibf56utgpPFotBER/mQ32lUE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000c0000000233f5-4.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fb-23.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f9-15.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fa-14.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fd-36.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fc-27.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fe-41.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233f6-47.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023400-60.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ff-51.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023403-73.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023401-72.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023402-63.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023404-80.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023407-88.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023405-94.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023408-101.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023409-108.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340c-129.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340b-130.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340a-119.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000c0000000233f5-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fb-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f9-15.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fa-14.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fd-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fc-27.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fe-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233f6-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023400-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ff-51.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023403-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023401-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023402-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023404-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023407-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023405-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023408-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023409-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340c-129.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340b-130.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340a-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/940-0-0x00007FF65D500000-0x00007FF65D851000-memory.dmp	UPX
behavioral2/files/0x000c0000000233f5-4.dat	UPX
behavioral2/memory/2940-6-0x00007FF692B60000-0x00007FF692EB1000-memory.dmp	UPX
behavioral2/files/0x00070000000233fb-23.dat	UPX
behavioral2/memory/1176-21-0x00007FF6ACD80000-0x00007FF6AD0D1000-memory.dmp	UPX
behavioral2/memory/3948-16-0x00007FF722130000-0x00007FF722481000-memory.dmp	UPX
behavioral2/files/0x00070000000233f9-15.dat	UPX
behavioral2/files/0x00070000000233fa-14.dat	UPX
behavioral2/memory/960-29-0x00007FF6FECE0000-0x00007FF6FF031000-memory.dmp	UPX
behavioral2/memory/4528-34-0x00007FF7558C0000-0x00007FF755C11000-memory.dmp	UPX
behavioral2/files/0x00070000000233fd-36.dat	UPX
behavioral2/files/0x00070000000233fc-27.dat	UPX
behavioral2/memory/4100-38-0x00007FF6F3F50000-0x00007FF6F42A1000-memory.dmp	UPX
behavioral2/files/0x00070000000233fe-41.dat	UPX
behavioral2/memory/1912-46-0x00007FF787490000-0x00007FF7877E1000-memory.dmp	UPX
behavioral2/files/0x00080000000233f6-47.dat	UPX
behavioral2/files/0x0007000000023400-60.dat	UPX
behavioral2/memory/3112-57-0x00007FF6E9680000-0x00007FF6E99D1000-memory.dmp	UPX
behavioral2/files/0x00070000000233ff-51.dat	UPX
behavioral2/memory/4788-50-0x00007FF7C11B0000-0x00007FF7C1501000-memory.dmp	UPX
behavioral2/memory/408-67-0x00007FF708A20000-0x00007FF708D71000-memory.dmp	UPX
behavioral2/memory/880-74-0x00007FF65A9E0000-0x00007FF65AD31000-memory.dmp	UPX
behavioral2/files/0x0007000000023403-73.dat	UPX
behavioral2/files/0x0007000000023401-72.dat	UPX
behavioral2/files/0x0007000000023402-63.dat	UPX
behavioral2/files/0x0007000000023404-80.dat	UPX
behavioral2/files/0x0007000000023407-88.dat	UPX
behavioral2/memory/2872-91-0x00007FF7A1CA0000-0x00007FF7A1FF1000-memory.dmp	UPX
behavioral2/memory/3756-93-0x00007FF7CEEF0000-0x00007FF7CF241000-memory.dmp	UPX
behavioral2/files/0x0007000000023405-94.dat	UPX
behavioral2/memory/3984-92-0x00007FF6E4A00000-0x00007FF6E4D51000-memory.dmp	UPX
behavioral2/memory/3900-90-0x00007FF738480000-0x00007FF7387D1000-memory.dmp	UPX
behavioral2/memory/4844-89-0x00007FF77F950000-0x00007FF77FCA1000-memory.dmp	UPX
behavioral2/files/0x0007000000023408-101.dat	UPX
behavioral2/files/0x0007000000023409-108.dat	UPX
behavioral2/memory/1480-124-0x00007FF6CBB50000-0x00007FF6CBEA1000-memory.dmp	UPX
behavioral2/memory/4400-127-0x00007FF72E150000-0x00007FF72E4A1000-memory.dmp	UPX
behavioral2/files/0x000700000002340c-129.dat	UPX
behavioral2/files/0x000700000002340b-130.dat	UPX
behavioral2/memory/4252-123-0x00007FF67FFA0000-0x00007FF6802F1000-memory.dmp	UPX
behavioral2/memory/1176-121-0x00007FF6ACD80000-0x00007FF6AD0D1000-memory.dmp	UPX
behavioral2/files/0x000700000002340a-119.dat	UPX
behavioral2/memory/960-112-0x00007FF6FECE0000-0x00007FF6FF031000-memory.dmp	UPX
behavioral2/memory/2940-111-0x00007FF692B60000-0x00007FF692EB1000-memory.dmp	UPX
behavioral2/memory/940-110-0x00007FF65D500000-0x00007FF65D851000-memory.dmp	UPX
behavioral2/memory/3948-109-0x00007FF722130000-0x00007FF722481000-memory.dmp	UPX
behavioral2/memory/1912-136-0x00007FF787490000-0x00007FF7877E1000-memory.dmp	UPX
behavioral2/memory/4016-134-0x00007FF768BD0000-0x00007FF768F21000-memory.dmp	UPX
behavioral2/memory/4432-137-0x00007FF6CD3E0000-0x00007FF6CD731000-memory.dmp	UPX
behavioral2/memory/4788-138-0x00007FF7C11B0000-0x00007FF7C1501000-memory.dmp	UPX
behavioral2/memory/408-140-0x00007FF708A20000-0x00007FF708D71000-memory.dmp	UPX
behavioral2/memory/3900-145-0x00007FF738480000-0x00007FF7387D1000-memory.dmp	UPX
behavioral2/memory/2872-146-0x00007FF7A1CA0000-0x00007FF7A1FF1000-memory.dmp	UPX
behavioral2/memory/3112-139-0x00007FF6E9680000-0x00007FF6E99D1000-memory.dmp	UPX
behavioral2/memory/880-142-0x00007FF65A9E0000-0x00007FF65AD31000-memory.dmp	UPX
behavioral2/memory/940-147-0x00007FF65D500000-0x00007FF65D851000-memory.dmp	UPX
behavioral2/memory/1480-156-0x00007FF6CBB50000-0x00007FF6CBEA1000-memory.dmp	UPX
behavioral2/memory/4016-158-0x00007FF768BD0000-0x00007FF768F21000-memory.dmp	UPX
behavioral2/memory/940-169-0x00007FF65D500000-0x00007FF65D851000-memory.dmp	UPX
behavioral2/memory/2940-205-0x00007FF692B60000-0x00007FF692EB1000-memory.dmp	UPX
behavioral2/memory/3948-207-0x00007FF722130000-0x00007FF722481000-memory.dmp	UPX
behavioral2/memory/1176-211-0x00007FF6ACD80000-0x00007FF6AD0D1000-memory.dmp	UPX
behavioral2/memory/960-210-0x00007FF6FECE0000-0x00007FF6FF031000-memory.dmp	UPX
behavioral2/memory/4528-214-0x00007FF7558C0000-0x00007FF755C11000-memory.dmp	UPX

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/960-29-0x00007FF6FECE0000-0x00007FF6FF031000-memory.dmp	xmrig
behavioral2/memory/4528-34-0x00007FF7558C0000-0x00007FF755C11000-memory.dmp	xmrig
behavioral2/memory/4100-38-0x00007FF6F3F50000-0x00007FF6F42A1000-memory.dmp	xmrig
behavioral2/memory/3756-93-0x00007FF7CEEF0000-0x00007FF7CF241000-memory.dmp	xmrig
behavioral2/memory/3984-92-0x00007FF6E4A00000-0x00007FF6E4D51000-memory.dmp	xmrig
behavioral2/memory/4844-89-0x00007FF77F950000-0x00007FF77FCA1000-memory.dmp	xmrig
behavioral2/memory/4400-127-0x00007FF72E150000-0x00007FF72E4A1000-memory.dmp	xmrig
behavioral2/memory/4252-123-0x00007FF67FFA0000-0x00007FF6802F1000-memory.dmp	xmrig
behavioral2/memory/1176-121-0x00007FF6ACD80000-0x00007FF6AD0D1000-memory.dmp	xmrig
behavioral2/memory/960-112-0x00007FF6FECE0000-0x00007FF6FF031000-memory.dmp	xmrig
behavioral2/memory/2940-111-0x00007FF692B60000-0x00007FF692EB1000-memory.dmp	xmrig
behavioral2/memory/940-110-0x00007FF65D500000-0x00007FF65D851000-memory.dmp	xmrig
behavioral2/memory/3948-109-0x00007FF722130000-0x00007FF722481000-memory.dmp	xmrig
behavioral2/memory/1912-136-0x00007FF787490000-0x00007FF7877E1000-memory.dmp	xmrig
behavioral2/memory/4432-137-0x00007FF6CD3E0000-0x00007FF6CD731000-memory.dmp	xmrig
behavioral2/memory/4788-138-0x00007FF7C11B0000-0x00007FF7C1501000-memory.dmp	xmrig
behavioral2/memory/408-140-0x00007FF708A20000-0x00007FF708D71000-memory.dmp	xmrig
behavioral2/memory/3900-145-0x00007FF738480000-0x00007FF7387D1000-memory.dmp	xmrig
behavioral2/memory/2872-146-0x00007FF7A1CA0000-0x00007FF7A1FF1000-memory.dmp	xmrig
behavioral2/memory/3112-139-0x00007FF6E9680000-0x00007FF6E99D1000-memory.dmp	xmrig
behavioral2/memory/880-142-0x00007FF65A9E0000-0x00007FF65AD31000-memory.dmp	xmrig
behavioral2/memory/940-147-0x00007FF65D500000-0x00007FF65D851000-memory.dmp	xmrig
behavioral2/memory/1480-156-0x00007FF6CBB50000-0x00007FF6CBEA1000-memory.dmp	xmrig
behavioral2/memory/4016-158-0x00007FF768BD0000-0x00007FF768F21000-memory.dmp	xmrig
behavioral2/memory/940-169-0x00007FF65D500000-0x00007FF65D851000-memory.dmp	xmrig
behavioral2/memory/2940-205-0x00007FF692B60000-0x00007FF692EB1000-memory.dmp	xmrig
behavioral2/memory/3948-207-0x00007FF722130000-0x00007FF722481000-memory.dmp	xmrig
behavioral2/memory/1176-211-0x00007FF6ACD80000-0x00007FF6AD0D1000-memory.dmp	xmrig
behavioral2/memory/960-210-0x00007FF6FECE0000-0x00007FF6FF031000-memory.dmp	xmrig
behavioral2/memory/4528-214-0x00007FF7558C0000-0x00007FF755C11000-memory.dmp	xmrig
behavioral2/memory/4100-215-0x00007FF6F3F50000-0x00007FF6F42A1000-memory.dmp	xmrig
behavioral2/memory/1912-217-0x00007FF787490000-0x00007FF7877E1000-memory.dmp	xmrig
behavioral2/memory/4788-219-0x00007FF7C11B0000-0x00007FF7C1501000-memory.dmp	xmrig
behavioral2/memory/408-221-0x00007FF708A20000-0x00007FF708D71000-memory.dmp	xmrig
behavioral2/memory/3112-223-0x00007FF6E9680000-0x00007FF6E99D1000-memory.dmp	xmrig
behavioral2/memory/3984-225-0x00007FF6E4A00000-0x00007FF6E4D51000-memory.dmp	xmrig
behavioral2/memory/3756-227-0x00007FF7CEEF0000-0x00007FF7CF241000-memory.dmp	xmrig
behavioral2/memory/4844-229-0x00007FF77F950000-0x00007FF77FCA1000-memory.dmp	xmrig
behavioral2/memory/880-231-0x00007FF65A9E0000-0x00007FF65AD31000-memory.dmp	xmrig
behavioral2/memory/2872-233-0x00007FF7A1CA0000-0x00007FF7A1FF1000-memory.dmp	xmrig
behavioral2/memory/3900-235-0x00007FF738480000-0x00007FF7387D1000-memory.dmp	xmrig
behavioral2/memory/4252-237-0x00007FF67FFA0000-0x00007FF6802F1000-memory.dmp	xmrig
behavioral2/memory/4400-239-0x00007FF72E150000-0x00007FF72E4A1000-memory.dmp	xmrig
behavioral2/memory/1480-241-0x00007FF6CBB50000-0x00007FF6CBEA1000-memory.dmp	xmrig
behavioral2/memory/4016-243-0x00007FF768BD0000-0x00007FF768F21000-memory.dmp	xmrig
behavioral2/memory/4432-245-0x00007FF6CD3E0000-0x00007FF6CD731000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2940	uJSbnDI.exe
3948	NFbkZwe.exe
960	KXauMPZ.exe
1176	IONoMKh.exe
4528	uCdBWRl.exe
4100	bsKWLZb.exe
1912	SaHjKVh.exe
4788	ZxlpmBX.exe
3112	JaYWifP.exe
408	RaulYYg.exe
880	HtaXXLt.exe
3984	kxbjwJM.exe
4844	aabwBIa.exe
3756	EvnTxJw.exe
3900	qaZTfpD.exe
2872	iskJxNA.exe
4252	MEYqRil.exe
1480	BhpTsqE.exe
4400	VqMzxiL.exe
4016	yJnghGz.exe
4432	yfkWNxq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/940-0-0x00007FF65D500000-0x00007FF65D851000-memory.dmp	upx
behavioral2/files/0x000c0000000233f5-4.dat	upx
behavioral2/memory/2940-6-0x00007FF692B60000-0x00007FF692EB1000-memory.dmp	upx
behavioral2/files/0x00070000000233fb-23.dat	upx
behavioral2/memory/1176-21-0x00007FF6ACD80000-0x00007FF6AD0D1000-memory.dmp	upx
behavioral2/memory/3948-16-0x00007FF722130000-0x00007FF722481000-memory.dmp	upx
behavioral2/files/0x00070000000233f9-15.dat	upx
behavioral2/files/0x00070000000233fa-14.dat	upx
behavioral2/memory/960-29-0x00007FF6FECE0000-0x00007FF6FF031000-memory.dmp	upx
behavioral2/memory/4528-34-0x00007FF7558C0000-0x00007FF755C11000-memory.dmp	upx
behavioral2/files/0x00070000000233fd-36.dat	upx
behavioral2/files/0x00070000000233fc-27.dat	upx
behavioral2/memory/4100-38-0x00007FF6F3F50000-0x00007FF6F42A1000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-41.dat	upx
behavioral2/memory/1912-46-0x00007FF787490000-0x00007FF7877E1000-memory.dmp	upx
behavioral2/files/0x00080000000233f6-47.dat	upx
behavioral2/files/0x0007000000023400-60.dat	upx
behavioral2/memory/3112-57-0x00007FF6E9680000-0x00007FF6E99D1000-memory.dmp	upx
behavioral2/files/0x00070000000233ff-51.dat	upx
behavioral2/memory/4788-50-0x00007FF7C11B0000-0x00007FF7C1501000-memory.dmp	upx
behavioral2/memory/408-67-0x00007FF708A20000-0x00007FF708D71000-memory.dmp	upx
behavioral2/memory/880-74-0x00007FF65A9E0000-0x00007FF65AD31000-memory.dmp	upx
behavioral2/files/0x0007000000023403-73.dat	upx
behavioral2/files/0x0007000000023401-72.dat	upx
behavioral2/files/0x0007000000023402-63.dat	upx
behavioral2/files/0x0007000000023404-80.dat	upx
behavioral2/files/0x0007000000023407-88.dat	upx
behavioral2/memory/2872-91-0x00007FF7A1CA0000-0x00007FF7A1FF1000-memory.dmp	upx
behavioral2/memory/3756-93-0x00007FF7CEEF0000-0x00007FF7CF241000-memory.dmp	upx
behavioral2/files/0x0007000000023405-94.dat	upx
behavioral2/memory/3984-92-0x00007FF6E4A00000-0x00007FF6E4D51000-memory.dmp	upx
behavioral2/memory/3900-90-0x00007FF738480000-0x00007FF7387D1000-memory.dmp	upx
behavioral2/memory/4844-89-0x00007FF77F950000-0x00007FF77FCA1000-memory.dmp	upx
behavioral2/files/0x0007000000023408-101.dat	upx
behavioral2/files/0x0007000000023409-108.dat	upx
behavioral2/memory/1480-124-0x00007FF6CBB50000-0x00007FF6CBEA1000-memory.dmp	upx
behavioral2/memory/4400-127-0x00007FF72E150000-0x00007FF72E4A1000-memory.dmp	upx
behavioral2/files/0x000700000002340c-129.dat	upx
behavioral2/files/0x000700000002340b-130.dat	upx
behavioral2/memory/4252-123-0x00007FF67FFA0000-0x00007FF6802F1000-memory.dmp	upx
behavioral2/memory/1176-121-0x00007FF6ACD80000-0x00007FF6AD0D1000-memory.dmp	upx
behavioral2/files/0x000700000002340a-119.dat	upx
behavioral2/memory/960-112-0x00007FF6FECE0000-0x00007FF6FF031000-memory.dmp	upx
behavioral2/memory/2940-111-0x00007FF692B60000-0x00007FF692EB1000-memory.dmp	upx
behavioral2/memory/940-110-0x00007FF65D500000-0x00007FF65D851000-memory.dmp	upx
behavioral2/memory/3948-109-0x00007FF722130000-0x00007FF722481000-memory.dmp	upx
behavioral2/memory/1912-136-0x00007FF787490000-0x00007FF7877E1000-memory.dmp	upx
behavioral2/memory/4016-134-0x00007FF768BD0000-0x00007FF768F21000-memory.dmp	upx
behavioral2/memory/4432-137-0x00007FF6CD3E0000-0x00007FF6CD731000-memory.dmp	upx
behavioral2/memory/4788-138-0x00007FF7C11B0000-0x00007FF7C1501000-memory.dmp	upx
behavioral2/memory/408-140-0x00007FF708A20000-0x00007FF708D71000-memory.dmp	upx
behavioral2/memory/3900-145-0x00007FF738480000-0x00007FF7387D1000-memory.dmp	upx
behavioral2/memory/2872-146-0x00007FF7A1CA0000-0x00007FF7A1FF1000-memory.dmp	upx
behavioral2/memory/3112-139-0x00007FF6E9680000-0x00007FF6E99D1000-memory.dmp	upx
behavioral2/memory/880-142-0x00007FF65A9E0000-0x00007FF65AD31000-memory.dmp	upx
behavioral2/memory/940-147-0x00007FF65D500000-0x00007FF65D851000-memory.dmp	upx
behavioral2/memory/1480-156-0x00007FF6CBB50000-0x00007FF6CBEA1000-memory.dmp	upx
behavioral2/memory/4016-158-0x00007FF768BD0000-0x00007FF768F21000-memory.dmp	upx
behavioral2/memory/940-169-0x00007FF65D500000-0x00007FF65D851000-memory.dmp	upx
behavioral2/memory/2940-205-0x00007FF692B60000-0x00007FF692EB1000-memory.dmp	upx
behavioral2/memory/3948-207-0x00007FF722130000-0x00007FF722481000-memory.dmp	upx
behavioral2/memory/1176-211-0x00007FF6ACD80000-0x00007FF6AD0D1000-memory.dmp	upx
behavioral2/memory/960-210-0x00007FF6FECE0000-0x00007FF6FF031000-memory.dmp	upx
behavioral2/memory/4528-214-0x00007FF7558C0000-0x00007FF755C11000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\MEYqRil.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VqMzxiL.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SaHjKVh.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RaulYYg.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HtaXXLt.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aabwBIa.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EvnTxJw.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZxlpmBX.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JaYWifP.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BhpTsqE.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yJnghGz.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yfkWNxq.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uJSbnDI.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KXauMPZ.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IONoMKh.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bsKWLZb.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kxbjwJM.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NFbkZwe.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uCdBWRl.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qaZTfpD.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iskJxNA.exe	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 2940	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	84
PID 940 wrote to memory of 2940	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	84
PID 940 wrote to memory of 3948	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	85
PID 940 wrote to memory of 3948	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	85
PID 940 wrote to memory of 960	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	86
PID 940 wrote to memory of 960	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	86
PID 940 wrote to memory of 1176	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	87
PID 940 wrote to memory of 1176	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	87
PID 940 wrote to memory of 4528	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	88
PID 940 wrote to memory of 4528	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	88
PID 940 wrote to memory of 4100	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	89
PID 940 wrote to memory of 4100	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	89
PID 940 wrote to memory of 1912	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	90
PID 940 wrote to memory of 1912	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	90
PID 940 wrote to memory of 4788	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	91
PID 940 wrote to memory of 4788	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	91
PID 940 wrote to memory of 3112	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	93
PID 940 wrote to memory of 3112	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	93
PID 940 wrote to memory of 408	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	94
PID 940 wrote to memory of 408	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	94
PID 940 wrote to memory of 3984	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	95
PID 940 wrote to memory of 3984	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	95
PID 940 wrote to memory of 880	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	96
PID 940 wrote to memory of 880	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	96
PID 940 wrote to memory of 4844	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	97
PID 940 wrote to memory of 4844	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	97
PID 940 wrote to memory of 3756	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	98
PID 940 wrote to memory of 3756	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	98
PID 940 wrote to memory of 3900	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	99
PID 940 wrote to memory of 3900	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	99
PID 940 wrote to memory of 2872	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	100
PID 940 wrote to memory of 2872	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	100
PID 940 wrote to memory of 4252	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	102
PID 940 wrote to memory of 4252	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	102
PID 940 wrote to memory of 1480	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	103
PID 940 wrote to memory of 1480	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	103
PID 940 wrote to memory of 4400	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	104
PID 940 wrote to memory of 4400	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	104
PID 940 wrote to memory of 4016	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	105
PID 940 wrote to memory of 4016	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	105
PID 940 wrote to memory of 4432	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	106
PID 940 wrote to memory of 4432	940	2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_9038eba5bd7b574f7df2ee28619883b2_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\System\uJSbnDI.exe
  C:\Windows\System\uJSbnDI.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\NFbkZwe.exe
  C:\Windows\System\NFbkZwe.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\KXauMPZ.exe
  C:\Windows\System\KXauMPZ.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\IONoMKh.exe
  C:\Windows\System\IONoMKh.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\uCdBWRl.exe
  C:\Windows\System\uCdBWRl.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\bsKWLZb.exe
  C:\Windows\System\bsKWLZb.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\SaHjKVh.exe
  C:\Windows\System\SaHjKVh.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\ZxlpmBX.exe
  C:\Windows\System\ZxlpmBX.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\JaYWifP.exe
  C:\Windows\System\JaYWifP.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\RaulYYg.exe
  C:\Windows\System\RaulYYg.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\kxbjwJM.exe
  C:\Windows\System\kxbjwJM.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\HtaXXLt.exe
  C:\Windows\System\HtaXXLt.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\aabwBIa.exe
  C:\Windows\System\aabwBIa.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\EvnTxJw.exe
  C:\Windows\System\EvnTxJw.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\qaZTfpD.exe
  C:\Windows\System\qaZTfpD.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\iskJxNA.exe
  C:\Windows\System\iskJxNA.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\MEYqRil.exe
  C:\Windows\System\MEYqRil.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\BhpTsqE.exe
  C:\Windows\System\BhpTsqE.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\VqMzxiL.exe
  C:\Windows\System\VqMzxiL.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\yJnghGz.exe
  C:\Windows\System\yJnghGz.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\yfkWNxq.exe
  C:\Windows\System\yfkWNxq.exe
  2⤵
  - Executes dropped EXE
  PID:4432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BhpTsqE.exe

Path C:\Windows\System\BhpTsqE.exe
Size 5.2MB
SHA256 07b5ddbf4bad2d8c06e30dd5c5362a91c9a08ef29d331c31b64a6902b37a785b
MD5 e5f8d6a1aff779fe265bca01700cf836
SHA1 1e1aa16bb4729f3885d9d7c9aa547e43e1727067
SHA512 821d711e174955177abdfc9f24fa7af8c73598ebebd0b38da306307bbffb9f632c5398bfb3e1c742d4292ca84874e71153dd0b83d23f5fc3dc327b7ebc6298f1
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lC:RWWBibf56utgpPFotBER/mQ32lUG
MD5 SHA1 SHA512 SSDEEP

Submit Download

EvnTxJw.exe

Path C:\Windows\System\EvnTxJw.exe
Size 5.2MB
SHA256 a75d87bede02fd2a26fe4d42b2d18767004a49cb097ba8db8c71386aa20a924d
MD5 def7cb526cbe3d538cfb4fb8ef2b5867
SHA1 d464fdff5f68182a6b101ca8c9a2329137d2a605
SHA512 57de88e2a6ed857913d6cf4db7463c0477d438425dffed1cc73fbfbe564b84334243c71c57236db6e301a97b832698aad3d458cad464c06ff4c09df69a7a18c5
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibf56utgpPFotBER/mQ32lU5
MD5 SHA1 SHA512 SSDEEP

Submit Download

HtaXXLt.exe

Path C:\Windows\System\HtaXXLt.exe
Size 5.2MB
SHA256 4fd5c4beeacf939d45cd42e53517d6f9e0aebf3e84180fc8c01154d7eeb4479d
MD5 29533a5e6029811d33bd4a05e11bbe41
SHA1 d4a8a0307908070a8624ca40c91a68ada0a33d52
SHA512 b1748df9aef7f572ffff317246bbd4b0bb7fc58bcff3e2c19286542bea7e4aed5ac9c077fafad15717cf7584e0497c1800dae81cafb1c161d9f96e49dab5b1d4
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBibf56utgpPFotBER/mQ32lUx
MD5 SHA1 SHA512 SSDEEP

Submit Download

IONoMKh.exe

Path C:\Windows\System\IONoMKh.exe
Size 5.2MB
SHA256 2a1988bab3a7ae4e659cf13648d0cd51ed438e73c9ad61b7615b35214cdb91ae
MD5 70b30289bfd36a336e1147122156e236
SHA1 2d6942675f5279be3592cc9e3be11cb7c58a16e8
SHA512 99cd5fef0e44084c88b45a9229f608f61b3eb1cb8a988ae993d70ea572ed2704caecbe28ee21d20a10c26f41f7ec32c644d3cb014cd20e0286fa28fbccbdb677
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lUG
MD5 SHA1 SHA512 SSDEEP

Submit Download

JaYWifP.exe

Path C:\Windows\System\JaYWifP.exe
Size 5.2MB
SHA256 8a01fa34e69a810dd09e7111d98e9cfb987b5351d0df49726e577e9ecca94c40
MD5 824e9580a2792116acee1f5a811d0e67
SHA1 7e2624fb1743daa327becf203e4d55729ea11a66
SHA512 5fecfc137a51910250d9d8323c6ee26b95855c51893fef70e6dee6b3434a1f49cc9cede1e385388c3ecd934da39b73d07be79d1cfe582f749bf5e57766a232fe
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibf56utgpPFotBER/mQ32lU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

KXauMPZ.exe

Path C:\Windows\System\KXauMPZ.exe
Size 5.2MB
SHA256 e70ce8232d3e4fb0ff5ecad0967871d01a93934a9c43d0bd712337a70acd8a09
MD5 3630a529f5d33e6acd3a8915fb0a4d40
SHA1 11c9517394802e0d02ad127daac5956e8b33bcac
SHA512 34144b12bc4ef0b796fd35468718bfe0703db943fb943429709341e3b89790813f7bea4fb533d7e82d07272114f42708e674cbb08444a98ee95224408d07bc17
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibf56utgpPFotBER/mQ32lUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

MEYqRil.exe

Path C:\Windows\System\MEYqRil.exe
Size 5.2MB
SHA256 5329186ca810ba736ce460b4fc0959949ce30c8bc505780414943d7f62a79cfb
MD5 670affbb522ea42b6920d8673577644d
SHA1 fdfc9b7263b267eb1412a11e90d05514b204709d
SHA512 c22c9f3798e760b8e527effee80e1004ada5d8806645c42d1c2e5860e0c47d5c8b0c10bae965ad34bbb0dd601b0b60fa117a68cae8ff6c8f2910a106451d2552
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lj:RWWBibf56utgpPFotBER/mQ32lUf
MD5 SHA1 SHA512 SSDEEP

Submit Download

NFbkZwe.exe

Path C:\Windows\System\NFbkZwe.exe
Size 5.2MB
SHA256 09e38a429538a608da4710905be39c5b6dde1bf88dceac65a163a1e1276e976b
MD5 85b3e682e2cb5fb3dcd515edc0f713f4
SHA1 c5f01b9cae3deb577979a9f9be2fff8ad2085c04
SHA512 8ed0468e640fc32836b53def781b5fa44895edc5ff4be8e794595b3ab2659456c0da8e1aef1de1b9b029503761a3e693fceddfd8092dc97271db8183eb4bab53
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibf56utgpPFotBER/mQ32lUI
MD5 SHA1 SHA512 SSDEEP

Submit Download

RaulYYg.exe

Path C:\Windows\System\RaulYYg.exe
Size 5.2MB
SHA256 61cd1e7eb555e2c1128296b170e0a4eb120c894922879440afd53c5b181bb382
MD5 8773b0dd81e99a69d8583892b5f476ba
SHA1 266937f15f7a8849789ed8f7d45c96939195670f
SHA512 39fc6a0efb1d1fc27d82dfc8df4dc73aabe0bc01f9c58302ccab8631c785dfe9f936637e4a40a276a9b84929fde2bac1748143b030171a7d58d49d754cf8b6da
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lUz
MD5 SHA1 SHA512 SSDEEP

Submit Download

SaHjKVh.exe

Path C:\Windows\System\SaHjKVh.exe
Size 5.2MB
SHA256 50e7bb17ad2c9c8c1171026f17bfc8367b122296e39dce0b22444da325575e34
MD5 a3670aed5001fc6b08f0084fc99224bb
SHA1 a1a5a65a95d0f763799c99aee572515e2617ca1c
SHA512 144cfb6febf63eabbd6ea88dff1f5ed2794800542bfc3718663e22c12f5762a06025cc0c325900b0121f96b17ac660bdbe033ce4f09f199c6631d3e654580e6b
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibf56utgpPFotBER/mQ32lU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

VqMzxiL.exe

Path C:\Windows\System\VqMzxiL.exe
Size 5.2MB
SHA256 386653e29d5b8be6b2568063272053d1fc2b2ab5b146679c6774e9eef928b0f2
MD5 9392e9c2d5e03761edb5ce59417f8319
SHA1 7900abb1f8706496bbc092ceff25635936d0ce53
SHA512 75222a28a04f31f7085324739f263ccf81d37837575932a4eec5613c662e85baecd1f61c8aeeb515292dd8f9ba27add149605ed97f81e41fa3c91ff2dfc96dee
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZxlpmBX.exe

Path C:\Windows\System\ZxlpmBX.exe
Size 5.2MB
SHA256 94732da5cd13a9abe966d5d6bb3c58f41653eb2df04334b8b95e2fe233a8022f
MD5 9118b5c4393b52fbf6a346013ec2c120
SHA1 25766280339c38e45cf9873fca9e9233b6525356
SHA512 1707097d1c2a5c415d6e69377d0755842689120ab878805aa17c55a4a56014b1cf82ae638549605c8e26cd60fa980aaed49afbb952789583745428f1351a1441
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lj:RWWBibf56utgpPFotBER/mQ32lUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

aabwBIa.exe

Path C:\Windows\System\aabwBIa.exe
Size 5.2MB
SHA256 357e8412f9d44ba1745018d6caf686249b889faecbf612eae0513a67f638fd20
MD5 d70c36722416f673dfdd291072dd8f60
SHA1 02b2e2fc1e81519d8037907b2e66867f50921685
SHA512 95ec9aa45fdcf6a25d1caa23770d1f33353c879d487da1984717954132de424f018fe3276672a9457311407fc94a9b545e173f55113a167b717fdb98901e34df
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUp
MD5 SHA1 SHA512 SSDEEP

Submit Download

bsKWLZb.exe

Path C:\Windows\System\bsKWLZb.exe
Size 5.2MB
SHA256 250834bf7086fa5de12eca9c4a999f2385343884a62dcdc7e211391624aeff92
MD5 4ab992c3f7843cbb38b517886ad12ad5
SHA1 2c74e5c52a93f206722a7d40e1f0f4bf47651ed7
SHA512 27df8124c2075a8c1532b768787a920c9c09a627e1cfd1f4f2f435d5d9f9a80fe40596a9eddbf09d1fa409813c7a995865338bc690bf61f68414589e3f062035
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibf56utgpPFotBER/mQ32lUk
MD5 SHA1 SHA512 SSDEEP

Submit Download

iskJxNA.exe

Path C:\Windows\System\iskJxNA.exe
Size 5.2MB
SHA256 88c1325c3c90b48be1ecb7ade8a2520266a2bdad237f35e6a6689cc7e4fe41b0
MD5 64584f363c90275042f3108b79a91b3a
SHA1 efa316b8c041b839e99cbeaf0e218bd16f49523a
SHA512 1c01103b01887cf870b6ab9b4e68bc4b22a79c4e308b0980c349319c601c7a1c920d2a7af69eacb86679cee2e5329817e5c63e8d32fa6e7cddf4eb1ece21b3e6
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibf56utgpPFotBER/mQ32lUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

kxbjwJM.exe

Path C:\Windows\System\kxbjwJM.exe
Size 5.2MB
SHA256 1bf64c663f99c437db87b3245275da53bbc0302cc263b7c14e6358bdd92f08c2
MD5 33019b6a2156c7d30c67b9cb5f74080e
SHA1 9919a0bf4a026f1b1fa7cffea6b6bab80fbfac56
SHA512 34ea14764d6f64e63df1cf1f0f3f8e98a54c89959f68b8d66b7cd03d91751a42f7cf840a7797dd41e603528b5f6e741e41b339f71674f47886b029dfa30ceb5f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibf56utgpPFotBER/mQ32lU/
MD5 SHA1 SHA512 SSDEEP

Submit Download

qaZTfpD.exe

Path C:\Windows\System\qaZTfpD.exe
Size 5.2MB
SHA256 4fe38faac42604e4c3af83208391d876ad99b7406525e1acafd26ca371492861
MD5 d5284dd1a30c624d8e6d2a30669420cf
SHA1 abd44ab7c4d6090b2ec51278ff0b1be9a10bf72e
SHA512 fbaac1e2889a08a84e2499f936a7bd7b82fb4b520f839f14c9fb35c55247bcebe360bbe4483ee51742f7e1d001572b15ee962791d84eaeaa45f639510fda4854
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibf56utgpPFotBER/mQ32lU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

uCdBWRl.exe

Path C:\Windows\System\uCdBWRl.exe
Size 5.2MB
SHA256 a263dff1b625d0bbda787a48ef422f96fbb2d7f3b2e5631a99e922e3e1ca1d21
MD5 dbe37621cc08eb8534642855ccc4b373
SHA1 829cd233614a76d16f86e9371e7c88796c7df19f
SHA512 1eb5a62534fe809bf124eea6acc665575fd44f783da50f1268a6866fca0cee934e41c47e6598591eedd919e32baebb635bd86099d4e2ed547dd8d8889c2984a2
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lS:RWWBibf56utgpPFotBER/mQ32lU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

uJSbnDI.exe

Path C:\Windows\System\uJSbnDI.exe
Size 5.2MB
SHA256 63ef177e4d9c019f90063579fb6b101c405ca16a80e4c056a0f412ef113c8242
MD5 cd86b3f877d70d68050a9a46584bdef3
SHA1 e2508eced594b17d50febcc5fccfb7b273e57e16
SHA512 637011b7148a6b7f6273671b094cc87b7e2dc0db4794c4a741c1fccac02e306a33cb1eb45b5d0e638602358136ab5021c9f67ed13948f4aeb0448db2aebdc6f1
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lo:RWWBibf56utgpPFotBER/mQ32lUU
MD5 SHA1 SHA512 SSDEEP

Submit Download

yJnghGz.exe

Path C:\Windows\System\yJnghGz.exe
Size 5.2MB
SHA256 1b8e19956d49a5964f4c7be5a5c832a51064e43ad8428f2bd97077449cf36e06
MD5 3539bcbcb1a0ff951b741a43f18e491c
SHA1 7a9974db2493a102ba2acc7744d0fd07b65dfc1d
SHA512 88be9b8e9dbced394f4c397b8be156451babc7ab26f1e9557eea3b25948249a5bbfa164addcb9ceaaff5aaa4daff54c65ee3dd7a91aa0d929d10dc4dac15b712
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibf56utgpPFotBER/mQ32lU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

yfkWNxq.exe

Path C:\Windows\System\yfkWNxq.exe
Size 5.2MB
SHA256 229c62efc8fdd69a1da64943174cce5ba60d0461f4be6246d26699f3b9e44ece
MD5 9fa536287262f49bf70b01caa4755382
SHA1 6ebe00b58ea3ff5c5e93d5632e89052a9f5bb961
SHA512 abec55eb21a67d04393619a5f27580ec5a66f1060078a3fb981a5d41b2a44cc17bddc920119f9c785b3f317e5a85f47b03b0be061f44568ac145ba74ead83ee9
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBibf56utgpPFotBER/mQ32lUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/408-140-0x00007FF708A20000-0x00007FF708D71000-memory.dmp

Download

memory/408-221-0x00007FF708A20000-0x00007FF708D71000-memory.dmp

Download

memory/408-67-0x00007FF708A20000-0x00007FF708D71000-memory.dmp

Download

memory/880-74-0x00007FF65A9E0000-0x00007FF65AD31000-memory.dmp

Download

memory/880-231-0x00007FF65A9E0000-0x00007FF65AD31000-memory.dmp

Download

memory/880-142-0x00007FF65A9E0000-0x00007FF65AD31000-memory.dmp

Download

memory/940-110-0x00007FF65D500000-0x00007FF65D851000-memory.dmp

Download

memory/940-169-0x00007FF65D500000-0x00007FF65D851000-memory.dmp

Download

memory/940-0-0x00007FF65D500000-0x00007FF65D851000-memory.dmp

Download

memory/940-147-0x00007FF65D500000-0x00007FF65D851000-memory.dmp

Download

memory/940-1-0x0000015FC5E70000-0x0000015FC5E80000-memory.dmp

Download

memory/960-210-0x00007FF6FECE0000-0x00007FF6FF031000-memory.dmp

Download

memory/960-112-0x00007FF6FECE0000-0x00007FF6FF031000-memory.dmp

Download

memory/960-29-0x00007FF6FECE0000-0x00007FF6FF031000-memory.dmp

Download

memory/1176-121-0x00007FF6ACD80000-0x00007FF6AD0D1000-memory.dmp

Download

memory/1176-21-0x00007FF6ACD80000-0x00007FF6AD0D1000-memory.dmp

Download

memory/1176-211-0x00007FF6ACD80000-0x00007FF6AD0D1000-memory.dmp

Download

memory/1480-241-0x00007FF6CBB50000-0x00007FF6CBEA1000-memory.dmp

Download

memory/1480-156-0x00007FF6CBB50000-0x00007FF6CBEA1000-memory.dmp

Download

memory/1480-124-0x00007FF6CBB50000-0x00007FF6CBEA1000-memory.dmp

Download

memory/1912-217-0x00007FF787490000-0x00007FF7877E1000-memory.dmp

Download

memory/1912-136-0x00007FF787490000-0x00007FF7877E1000-memory.dmp

Download

memory/1912-46-0x00007FF787490000-0x00007FF7877E1000-memory.dmp

Download

memory/2872-146-0x00007FF7A1CA0000-0x00007FF7A1FF1000-memory.dmp

Download

memory/2872-91-0x00007FF7A1CA0000-0x00007FF7A1FF1000-memory.dmp

Download

memory/2872-233-0x00007FF7A1CA0000-0x00007FF7A1FF1000-memory.dmp

Download

memory/2940-111-0x00007FF692B60000-0x00007FF692EB1000-memory.dmp

Download

memory/2940-6-0x00007FF692B60000-0x00007FF692EB1000-memory.dmp

Download

memory/2940-205-0x00007FF692B60000-0x00007FF692EB1000-memory.dmp

Download

memory/3112-223-0x00007FF6E9680000-0x00007FF6E99D1000-memory.dmp

Download

memory/3112-57-0x00007FF6E9680000-0x00007FF6E99D1000-memory.dmp

Download

memory/3112-139-0x00007FF6E9680000-0x00007FF6E99D1000-memory.dmp

Download

memory/3756-227-0x00007FF7CEEF0000-0x00007FF7CF241000-memory.dmp

Download

memory/3756-93-0x00007FF7CEEF0000-0x00007FF7CF241000-memory.dmp

Download

memory/3900-145-0x00007FF738480000-0x00007FF7387D1000-memory.dmp

Download

memory/3900-235-0x00007FF738480000-0x00007FF7387D1000-memory.dmp

Download

memory/3900-90-0x00007FF738480000-0x00007FF7387D1000-memory.dmp

Download

memory/3948-109-0x00007FF722130000-0x00007FF722481000-memory.dmp

Download

memory/3948-207-0x00007FF722130000-0x00007FF722481000-memory.dmp

Download

memory/3948-16-0x00007FF722130000-0x00007FF722481000-memory.dmp

Download

memory/3984-225-0x00007FF6E4A00000-0x00007FF6E4D51000-memory.dmp

Download

memory/3984-92-0x00007FF6E4A00000-0x00007FF6E4D51000-memory.dmp

Download

memory/4016-158-0x00007FF768BD0000-0x00007FF768F21000-memory.dmp

Download

memory/4016-134-0x00007FF768BD0000-0x00007FF768F21000-memory.dmp

Download

memory/4016-243-0x00007FF768BD0000-0x00007FF768F21000-memory.dmp

Download

memory/4100-215-0x00007FF6F3F50000-0x00007FF6F42A1000-memory.dmp

Download

memory/4100-38-0x00007FF6F3F50000-0x00007FF6F42A1000-memory.dmp

Download

memory/4252-237-0x00007FF67FFA0000-0x00007FF6802F1000-memory.dmp

Download

memory/4252-123-0x00007FF67FFA0000-0x00007FF6802F1000-memory.dmp

Download

memory/4400-239-0x00007FF72E150000-0x00007FF72E4A1000-memory.dmp

Download

memory/4400-127-0x00007FF72E150000-0x00007FF72E4A1000-memory.dmp

Download

memory/4432-137-0x00007FF6CD3E0000-0x00007FF6CD731000-memory.dmp

Download

memory/4432-245-0x00007FF6CD3E0000-0x00007FF6CD731000-memory.dmp

Download

memory/4528-34-0x00007FF7558C0000-0x00007FF755C11000-memory.dmp

Download

memory/4528-214-0x00007FF7558C0000-0x00007FF755C11000-memory.dmp

Download

memory/4788-50-0x00007FF7C11B0000-0x00007FF7C1501000-memory.dmp

Download

memory/4788-219-0x00007FF7C11B0000-0x00007FF7C1501000-memory.dmp

Download

memory/4788-138-0x00007FF7C11B0000-0x00007FF7C1501000-memory.dmp

Download

memory/4844-229-0x00007FF77F950000-0x00007FF77FCA1000-memory.dmp

Download

memory/4844-89-0x00007FF77F950000-0x00007FF77FCA1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads